linux-kernel - Re: [char-misc-next v4 0/3] mei: fix mei

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025071911-banker-skewer-ae65@gregkh>
Date: Sat, 19 Jul 2025 09:58:35 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Alexander Usyskin <alexander.usyskin@...el.com>
Cc: Reuven Abliyev <reuven.abliyev@...el.com>, linux-kernel@...r.kernel.org
Subject: Re: [char-misc-next v4 0/3] mei: fix mei_device lifetime

On Thu, Jul 17, 2025 at 05:11:09PM +0300, Alexander Usyskin wrote:
> mei_device data structure is allocated using devm_* functions
> and hooked to the parent device.
> It works for client systems where parent device is pci one.
> When parent device is auxiliary bus device produced by
> graphics driver, the parent can be destroyed before child
> and on the way it cleans all allocated memory.
> This leads to use-after-free if mei character device is
> opened when parent device is destroyed.
> 
> Connect mei_device structure lifteme to mei class device lifetime
> by adding mei_device free to class device remove callback.
> Decouple character device lifetime from parwnt structure lifetime.
> 
> As dev pointer in mei_device structure is converted to non-pointer
> device all dev_* calls should be touched in this patch series.
> 
> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14201

I took the first 2 patches now, as they are "simple".  Give me some more
time to get a chance to review the last one, thanks.

greg k-h